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ABSTRACT 

A  new  methodology  was  developed  for  quantitatively  de¬ 
termining  the  explosive  hazards  of  launch  systems  that 
use  large  rocket  motors  containing  solid  propellant.  The 
method  is  generally  applicable  to  all  large  military,  space, 
and  commercial  launch  vehicles.  In  a  failed  launch,  solid 
propellant  ultimately  impacts  the  ground,  which  can  lead 
to  an  explosion  and  production  of  blast  waves  that  can 
cause  damage  to  people  and  property.  The  extent  of  the 
energy  release  (severity)  and  the  chance  of  the  event  (prob¬ 
ability)  determine  if  the  launch  is  “safe.” 

This  development  was  sponsored  by  an  Air  Force  pro¬ 
gram  for  a  new  TITAN  IV  vehicle  to  be  launched  at  both 
the  Eastern  and  Western  Ranges.  The  goal  of  the  smdy 
was  to  determine  propellant  ground  impact  patterns  (foot¬ 
prints)  for  various  failure  modes  and  to  determine  the  func¬ 
tion,  probability  of  exceeding  various  levels  of  blast  over¬ 
pressure,  at  several  vulnerable  locations  surrounding  the 
launch  site.  The  results  of  the  analysis  are  presented  for  a 
TITAN  rV  launch  from  Launch  Complex  41  at  the  East¬ 
ern  Range  (Cape  Canaveral  Air  Force  Station)  for  a  nomi¬ 
nal  Cassini  mission.  Data  are  included  for  each  of  ten 
vulnerable  locations.  It  is  shown  that  for  all  but  the  launch 
site  itself,  such  a  launch  is  generally  “safe.” 

INTRODUCTION 

An  important  part  of  launch  operations  (vs.  test)  of  a  new 
large  military  or  space  vehicle  is  the  evaluation  of  risk  to 
test  range  personnel,  spectators  and  facilities.  Permis¬ 
sion  to  launch  is  primarily  based  on  this  evaluation,  which 
is  required  for  every  system  to  be  launched  and  may  takes 
several  years  to  complete.  Risk  is  usually  defined  as  the 
product  of  the  probability  of  a  failure  and  the  consequences 
of  that  failure  summed  over  all  credible  failures. 

TRW  developed  a  new  general  methodology  to  quantita¬ 
tively  assess  the  explosive  hazards  (i.e.,  risks)  of  launch 
of  systems  that  use  large  rocket  motors  containing  solid 
propellant.  If  the  system  fails,  propellant  can  impact  the 
ground,  release  explosive  energy  and  produce  blast  waves 
that  reach  people  or  vulnerable  facilities. 
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The  method,  generally  applicable  to  all  large  military, 
space  and  commercial  launch  vehicles,  was  developed 
during  the  evaluation  of  an  Eastern  Range  launch  of  the 
TITAN  rV  vehicle  that  uses  two  Solid  Rocket  Motor  Up¬ 
grade  (SRMU)  boosters.  The  effort  was  initiated  to  de¬ 
velop  an  alternate,  more  realistic,  methodology  because 
the  Air  Force  TITAN  IV  SPO  (Systems  Program  Office) 
was  concerned  that  the  currently  used  methods  for  evalu¬ 
ating  range  safety  could  be  unnecessarily  conservative 
making  it  difficult  to  achieve  launch  approval. 

The  methodology  developed  used  the  TITAN  IV  Cassini 
mission  as  a  basis  because  most  of  the  required  informa¬ 
tion  was  readily  available.  Whenever  possible,  failure 
modes  and  effects  data  (discussed  below)  were  taken  from 
Lockheed-Martin  Aerospace  (the  prime  contractor  for  TI¬ 
TAN  rV)  engineering  sources.  In  a  few  instances  where 
data  were  not  yet  available,  engineering  experience  and 
judgement  were  used  to  complete  the  data  base. 

Neither  the  Air  Force  nor  Lockheed-Martin  Aerospace 
has  been  asked  to  validate  this  representation  of  the  TI¬ 
TAN  rV  solid  rocket  motor  launch  hazards.  The  method 
developed,  using  the  stated  mission  example,  has  been 
presented  to  the  Air  Force  TITAN  IV  SPO,  Lockheed- 
Martin  Aerospace  personnel  and  CCAS  (Cape  Canaveral 
Air  Station)  and  VAFB  (Vandenberg  Air  Force  Base)  range 
personnel  and  their  contractors.  TITAN  IV  with  SRMU 
is  currently  going  through  its  launch  approval  cycle  based 
on  currently  used  modeling  techniques.  TRW  believes 
that  the  presented  methodology  is  the  approach  of  the 
future  for  launch  hazards  safety  evaluations. 

SOLID  PROPELI.ANT  HAZARDS 

Solid  propellants  have  been  used  in  rocket  motors  since 
WW  H;  remember  JATO’s  (Jet  Assisted  Take  Off).  Be¬ 
cause  of  their  simplicity,  high  mass  fraction  and  low  cost 
compared  to  liquids,  solid  propellant  rocket  motors  have 
become  standard  boosters  for  liftoff  of  large  military  and 
commercial  space  systems  (consider  TITAN,  the  Shuttle 
and  Ariane).  Although  the  type  of  solid  propellant  used 
in  these  applications  (designated  Class  1.3  propellant)  has 
traditionally  been  considered  to  burn  or  deflagrate  only 
(as  it  does  in  a  rocket  motor)  we  now  know  that  it  can 
also  detonate  or  explode  when  impacting  surfaces  at  high 
speed,  and  that  this  event  will  produce  blast  waves  in  the 
surrounding  air  just  as  high  explosives  do.  Thus  there  is 
justifiable  concern  every  time  a  system  with  large  solid 
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rocket  motors  is  launched  in  that  a  failure  could  lead  to 
the  explosion  of  a  significant  portion  of  the  solid  propel¬ 
lant  aboard.  For  TITAN  IV,  the  total  amount  of  propel¬ 
lant  is  approximately  1,400,000  pounds  while  for  the 
Shuttle  the  total  is  about  2,200,000  pounds.  The  hazards 
associated  with  such  an  event  are  potentially  great  and 
warrant  an  investigation,  via  appropriate  methodology, 
into  the  quantification  of  risk. 

GOAI.S  OF  THE  METHQDOT.OGY 

The  overall  methodology  development  described  in  this 
paper  is  based  on  an  update  of  launch  hazards  technology 
previously  and  successfully  developed  under  various  bal¬ 
listic  missile  programs.  Much  of  the  original  methodol¬ 
ogy  was  reviewed,  evaluated  and  approved  by  a  commit¬ 
tee  of  national  experts. 

As  indicated  above,  there  is  a  risk  at  any  vulnerable  loca¬ 
tion  at  or  near  the  launch  site  that  a  system  failure  could 
cause  casualties  or  serious  damage.  For  each  credible 
failure  mode,  we  are  interested  in  the  product  of  the  prob¬ 
ability  of  that  failure  and  the  severity  of  the  event.  In 
terms  of  the  risks  with  solid  propellant  rocket  motors,  the 
extent  of  the  explosive  energy  release  on  ground  impact 
measures  “severity”  because  the  impact  will  generate  blast 
waves  that  can  travel  from  the  ground  impact  site  to  the 
vulnerable  location.  It  is  the  blast  waves  that  cause  dam¬ 
age.  Since  these  kinds  of  data  have  been  compiled  over 
many  years,  using  TNT  as  a  “standard”  explosive  mate¬ 
rial,  we  can  relate  severity  directly  to  the  amount  of  pro¬ 
pellant  hitting  the  ground. 

The  “probability  of  the  failure”  is  measured  by  a  series 
of  probabilistic  and  deterministic  events  that  precede 
ground  impact  (discussed  under  Event  Trees  below)  but 
is  traced  back  to  the  original  failure  aboard  the  vehicle 
that  resulted  in  these  particular  events.  The  probability 
of  this  failure  is  usually  measured  by  the  system  reliabil¬ 
ity,  specifications,  or  tests  available  in  documents  such  as 
the  FMEA  (Failure  Modes  and  Effects  Analyses). 

The  overall  goals  of  the  methodology  can  be  stated  as 
follows: 

•  Choose  vulnerable  locations  (people/facilities) 

•  Determine  ground  impact  “footprints”  of  propellant 
(how  much,  how  fast,  where,  and  when)  for  each  fail¬ 
ure  time,  for  each  failure  mode 

•  Determine  the  function,  probability  of  exceeding  blast 
overpressure  vs  blast  overpressure,  at  the  vulnerable  lo¬ 
cation  (the  result  is  in  the  form  of  a  probability  distri¬ 
bution) 


Benefits  of  this  developed  methodology  include  the  use 
of  analytic  probabilistic  procedures.  Scientific/engineer¬ 
ing  calculations  are  used  whenever  possible  to  explicitly 
treat  the  physics  of  any  particular  event;  probabilistic  cal¬ 
culations  are  used  only  when  this  is  not  possible.  No 
Monte  Carlo  techniques  are  employed. 

The  results  can  be  used  directly  by  the  range  to  determine 
risk.  If  low  enough,  either  due  to  low  probability  or  low 
severity,  launch  hazard  risk  may  be  acceptable.  If  not 
low  enough,  the  method  will  help  identify  and  evaluate 
mitigation  approaches. 

METHODOLOGY  ROADMAP 

The  methodology  consists  of  the  development  of  a  data¬ 
base  of  salient  features  of  the  vehicle  to  be  launched  and 
of  the  launch  site,  the  determination  of  the  relevant  set  of 
failure  modes  that  can  lead  to  propellant/ground  impact, 
the  evaluation  of  the  specific  spatial  trajectories  of  both 
uncontrolled  (ballistic)  propellant  (fragments,  rocket  mo¬ 
tor  segments)  and  controlled  propellant  (full  boosters  or 
the  entire  vehicle)  to  determine  ground  impact  locations 
and  impact  velocities,  the  determination  of  explosive  en¬ 
ergy  release  and  blast  overpressure  for  each  propellant 
item  based  on  a  TRW  developed  yield  correlation,  and 
(using  probability  “chains”  for  all  failure  modes  and  times 
of  failure)  appropriate  summation  of  all  the  individual 
probabilities  (for  all  propellant  items  impacting  the 
ground)  to  give  the  desired  function,  the  probability  of 
exceeding  blast  overpressure  for  each  vulnerable  location. 

Each  of  these  steps  is  described  below  in  detail.  The  steps 
can  be  matched  with  the  flow  diagram  in  Figure  1.  The 
entire  process  is  a  classic  example  of  systems  engineer¬ 
ing  utilizing  the  skills  and  capabilities  of  engineers  trained 
in  various  technical  disciplines  such  as  aerodynamics, 
guidance  and  control,  rocket  motors,  propellant  technol¬ 
ogy,  structures,  detonation  physics  and  probability  and 
statistics. 

Database 

Before  attempting  to  evaluate  the  relevant  potential  fail¬ 
ures  of  the  launch  process,  a  substantial  database  regard¬ 
ing  both  the  system  to  be  launched  and  the  launch  site  is 
required. 

For  TITAN  IV  SRMU  (Figure  2),  interest  is  focused  on 
the  SRMU  booster  systems  since  that  is  where  the  major¬ 
ity  of  solid  propellant  is  located.  For  the  particular  mis¬ 
sion  being  planned,  data  were  gathered  on  the  structural 
attachments,  the  three-segment  SRMU  design  including 
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Figure  1.  Methodology  Roadmap  Flow  Diagram 


motor  performance  parameters,  the  Guidance  and  Con¬ 
trol  (G&C)  characteristics  including  nominal  trajectories 
and,  very  importantly,  the  automatic  destruct  systems 
which  play  a  major  role  in  determining  the  state  of  the 
propellant  after  a  system  failure.  In  particular,  these  sys¬ 
tems  are  designed  to  “cut”  the  operating  rocket  motor  case 
with  a  device  called  a  linear  shaped-charge,  such  that  the 


graphite-epoxy  filament-wound  case  completely  unrav¬ 
els.  Thus,  removing  external  restraint  on  the  burning  pro¬ 
pellant  grain  will  immediately  result  in  fragmentation  and 
radial  expulsion  of  the  remaining  propellant;  this  process 
defines  the  size  distribution  of  the  propellant  under  these 
circumstances.  The  system  is  designed  such  that  this  will 
occur  either  1)  by  manual  command  by  Range  Safety,  2) 
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by  sufficient  inadvertent  physical  separation  of  the  SRMU 
from  the  central  (core)  vehicle,  or  3)  by  activation  of  a 
“thermal  barrier”  due  to  an  upper  stage  explosion.  As 
discussed  below,  when  these  destruct  systems  are  not  ac¬ 
tivated,  the  propellant  is  generally  intact,  either  as  indi¬ 
vidual  segments  or  as  a  complete  SRMU.  This  has  sig¬ 
nificant  implications  for  explosive  energy  release. 

The  characteristics  of  the  launch  site  are  also  of  interest. 
Vulnerable  locations  at  or  near  the  launch  pad  were  iden¬ 
tified  and  precisely  located  with  respect  to  the  launch  pad 
(see  Figure  3).  Terrain  in  the  vicinity  was  identified  and 
classified  as  either  water,  based  on  the  Eastern  Test  Range 
coastline  (which  was  analytically  modeled),  sand  between 
vulnerable  locations  or  concrete  at  the  launch  pad.  The 
characteristics  of  these  surfaces  determine  the  extent  of 
explosive  reaction  when  impacted  by  propellant. 

Another  important  feature  of  the  site  is  the  reaction  time 
of  Range  Safety  Launch  Operations  Ifom  a  failure  event 
to  activation  of  the  manual  flight  termination  system.  This 
usually  consists  of  data  link  and  processing  time  plus  re¬ 
action  and  decision  time.  Since  it  is  known  that  large 
propellant  pieces  are  “worse”  than  smaller  propellant 
pieces  and  that  flight  termination  will  lead  to  the  above- 
mentioned  propellant  fragmentation,  short  reaction  times 
are  clearly  most  desirable.  Therefore,  to  make  the  analy¬ 
sis  tractable  while  being  “conservative,”  a  reasonable  worst 
case  (i.e.,  largest)  reaction  time  was  determined  for  two 
cases:  7  seconds  for  quick  recognition  when  the  failure 
is  obvious  and  13  seconds  when  there  is  slow  recogni¬ 
tion. 

Failure  Modes 

The  determination  of  an  appropriate  list  of  failure  modes 
is  difficult  but  essential  to  the  fidelity  and  usefulness  of 
the  methodology  depicted  in  Figure  1.  On  the  one  hand, 
it  is  critical  to  develop  a  comprehensive  enough  list  that 
all  the  likely  cases  (that  lead  to  significant  consequences) 
are  considered  while  on  the  other  hand  excluding  a  mul¬ 
tiplicity  of  unlikely  or  non  consequential  cases  that  will 
make  the  analysis  intractable.  For  the  TITAN  FV  SRMU 
study,  we  organized  failures  in  terms  of  failure  groups: 
rocket  motor  failures,  G&C  failures  and  structural  fail¬ 
ures.  From  these  we  define  specific  “single  point  failure 
modes”  that  lead,  through  “event  trees,”  to  specific  pro¬ 
pellant  states  that  impact  the  ground. 

Failure  Groups  and  Modes 


Within  the  rocket  motor  failure  group,  the  failure  modes 
Figured  Titan IV SRMU  considered  were  non-ignition  of  one  of  the  two  SRMUs 
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Figure  3.  Vulnerable  Locations  At  Launch  Site  (LC41) 


at  launch,  seal-leakage  between  segments  as  in  the  Shuttle 
Challenger  disaster,  rocket  motor  case  failure  such  as  a 
burn-through,  a  “blown”  (loss  of  the)  throat,  loss  of  the 
exit  cone  and  a  damaged  exit  cone. 

For  the  G&C  failure  group,  the  failure  modes  considered 
(all  but  one)  led  to  abnormal  motion  of  one  or  both  of  the 
TVAs  (Thrust  Vector  Actuators)  on  the  SRMU  which  steer 
the  entire  system  during  the  early  part  of  flight  up  to  120 
seconds.  The  failure  modes  are  TVA(s)  hardover  as  far 
as  they  can  go  (26  subcases  since  there  are  two  TVAs  per 
SRMU  and  two  SRMUs),  TVAs  null,  one  TVA  constant 
at  last  position  (4  subcases)  and  all  TVAs  constant  at  last 
position.  The  final  G&C  failure  mode  is  inadvertent  early 
separation  of  the  SRMUs  which  are  supposed  to  separate 
after  burnout. 


The  structural  failure  group  considered  two  failure  modes, 
collapse  of  the  core  vehicle  and  Centaur  failure  which 
includes  the  upper  stages  forward  of  the  core  vehicle. 

Failure  Modes  are  summarized  in  Figure  4. 

Failure  modes  are  called  “single  point  failure  modes”  and 
are  specific  events  that  form  the  starting  point  of  an  event 
tree.  They  are  identifiable  in  that  a  numerical  probability 
of  the  event  can  be  determined  either  from  component/ 
subsystem/system  reliability  data,  from  customer  require¬ 
ments  or  by  actual  test. 

These  data  are  sometimes  compiled  in  a  FMEA  (Failure 
Modes  and  Effects  Analysis)  document  for  the  system. 
Because  we  are  concerned  only  with  those  failures  that 


5 

American  Institute  of  Aeronautics  and  Astronautics 


Group 

Mode 

Single  Point  Failure  Name  -  Description 

Rocket 

FM1 

Single  SRMU  fails  to  Ignite  -  Tip  over  - 
2  subcases 

FM2 

Seal  leakage  -  Segment  field  joint  - 
2  subcases 

Motor 

FM3 

Case  failure  -  Burnthrough,  burst,  etc.  - 
2  subcases 

FM4 

“Blown"  throat  -  Nozzle  throat  loss  - 
2  subcases 

Failures 

FM5 

Exit  cone  loss  -  Nozzle  intact  - 
2  subcases 

FM6 

Damaged  exit  cone  -  2  subcases 

FM7 

TVA(s)  hardover  -  26  subcases 

G&C 

FM8 

TVA(s)  null  -  2  subcases 

FM9 

One  TVA  constant  at  last  position  - 
4  subcases 

Failures 

FM10 

All  TVAs  constant  at  last  position  - 
2  subcases 

FM11 

Inadvertent  separation  -  SRMUs 
separate  from  core 

Structural 

FM12 

Centaur  failure 

Failures 

FM13 

Core  collapse 

Figure  4.  Failure  Modes 


lead  to  propellant  impact  on  the  ground,  the  “book”  val¬ 
ues  of  the  probabilities  (or  reliability)  must  be  modified 
by  1)  the  proportion  of  all  failures  of  the  type  under  con¬ 
sideration  that  will  lead  to  propellant-ground  impact  and 

2)  the  proportion  of  time  over  which  the  analysis  is  con¬ 
cerned  (i.e.,  while  ground  impact  is  still  possible)  com¬ 
pared  to  the  time  over  which  the  reliability  is  specified. 
These  two  “correction”  factors  are  to  be  multiplied  by 
the  quantity  (one  minus  reliability)  to  yield  the  probabil¬ 
ity  of  the  failure  mode. 

Event  IVees 

For  each  single  point  failure  there  is  a  series  of  (perhaps 
many)  following,  or  consequential,  events  that  includes 
1)  deterministic  paths  in  which  following  events  are 
known  or  can  be  analyzed,  2)  alternate  paths  in  which  the 
probability  values  are  fixed  by  engineering  judgement, 

3)  paths  in  which  a  series  of  alternatives  is  known  to  be 
equally  likely  (the  probability  is  divided  among  the  num¬ 
ber  of  paths),  and  4)  alternative  paths  that  are  determined 
by  a  6  DOF  (Degree-of-Freedom)  simulation  analysis 
which  shows  that  these  alternate  event  probabilities 
change  with  time-of-failure.  Some  of  the  branch  points 
reached  after  the  single  point  failure  may  lead  to  conse¬ 
quential  failures  including  further  structural  failure  of  the 
vehicle. 


the  state  of  the  propellant  on  impact.  Five  states  are  rec¬ 
ognized.  Propellant  impacts  either  as  fragments,  intact 
single  segments,  intact  attached  segments,  intact  SRMUs 
or  as  the  entire  vehicle  with  two  SRMUs. 

Technically,  there  are  as  many  event  trees  as  single  point 
failures  (48  in  all).  For  convenience,  since  many  are  simi¬ 
lar,  the  study  grouped  them  into  13  failure  modes.  Ex¬ 
ample  event  trees  are  shown  in  Figures  5  and  6. 

The  event  tree  specifies  the  probability  of  each  particular 
path  starting  from  the  single  point  failure,  through  the 
various  branch  probabilities,  to  the  final  states. 

Also  the  event  trees  are  to  be  analyzed  in  detail  to  deter¬ 
mine  what  size  propellant  pieces  impact  the  ground,  where 
they  hit  and  how  fast.  This  is  seen  in  the  middle  section 
of  Figure  1,  which  refers  to  a  series  of  “supporting  analy¬ 
ses”  that  are,  for  convenience,  divided  into  the  Tip-Over, 
Intact  Vehicle  and  Failed  Motor  Segment  cases.  Note  that 
in  each  instance  a  trajectory  analysis  is  performed  of  the 
solid  propellant  to  the  ground  in  order  to  determine  its 
fate  at  impact. 

TVajectories 

The  Up-Over  case  is  unique  in  that  it  is  derived  directly 
from  the  single  failure  mode;  one  SRMU  fails  to  ignite. 
The  system  barely  leaves  the  ground  but  the  consequences 
are  significant.  The  Intact  Vehicle  case  occurs  when  both 
SRMUs  impact  the  ground  intact  (either  jointly  or  sepa¬ 
rately)  after  the  system  has  become  airborne.  The  Failed 
Motor  case  comes  about  when  either  SRMU  case  fails 
due  activation  of  the  Flight  Termination  System  (FTS),  a 
burnthrough,  etc.,  and  fragmented  propellant  is  produced 
(because  of  the  internal  pressure)  along  with  intact  seg¬ 
ments.  These  are  illustrated  in  Figure  1. 

Tip-Over  Case 

When  one  SRMU  fails  to  ignite,  it  can  be  shown  that  the 
“hot”  SRMU,  still  attached  core  vehicle,  will  accelerate 
and  break  the  forward  attachments  to  the  “cold”  SRMU, 
leaving  it  unsupported  on  the  stand.  The  cold  SRMU  will 
tip  over  and  fall  to  the  ground  landing  on  its  side.  An 
analysis  of  this  event  shows  that  all  segments  impact  at 
essentially  the  same  time  but  with  considerably  varying 
impact  velocity;  approximately  30  ft/sec  at  the  aft  seg¬ 
ment  c.g.,  70  ft/sec  at  the  center  segment  c.g.  and  100  ft/ 
sec  at  the  forward  segment  c.g. 


By  definition  for  this  study,  each  event  tree  results  in  pro¬ 
pellant  impacting  the  ground  or  water.  Therefore,  in  ev¬ 
ery  case  the  end  of  the  branch  (last  box  on  the  right)  is 


These  velocity  differences,  and  the  respective  weights  of 
the  individual  will  lead  to  different  explosive  yields  for 
each  segment  (see  Explosive  Yield  Correlation  below). 
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IMPACT  SRMU 


7 

American  Institute  of  Aeronautics  and  Astronautics 


Figure  5.  Failure  Mode  1:  Single  SRMU  Fails  To  Ignite 


1*R4  =  9.67E-4  [SRMU  FMEA] 
F14  =  1.0 

F24  =  DT/TMAX4 

TMAX  =  140  SEC 
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Figure  6.  Failure  Mode  4:  "Blown"  Throat 


Further,  the  computed  yield  for  each  segment  is  statisti¬ 
cally  distributed.  Because  the  segments  are  effectively 
independent  when  they  land,  the  yields  generated  are  sta¬ 
tistically  added,  using  a  procedure  which  uses  a  convolu¬ 
tion  integral,  to  get  the  correct  distribution  of  yield  for  all 
three  segments.  As  discussed  below,  the  Tip-Over  case 
results  in  a  significant  explosion  at  the  launch  site. 

The  hot  SRMU/core  combination  is  capable  of  flying  a 
short  distance  horizontally  but  does  not  have  enough  thrust 
to  lift  off.  It  will  also  impact  (concrete)  in  the  launch  pad 
vicinity  but  the  hot  SRMU  will  be  cushioned  by  the  core 
vehicle  which  lands  first.  The  calculated  vertical  impact 
velocities  ranging  from  80-120  ft/sec  depending  on  the 
degree  of  damage  to  the  exit  cone  in  the  separation  of  the 
cold  SRMU,  will  be  reduced  significantly  to  35-50  ft/ 
sec.  The  corresponding  yield  is  computed  as  for  the  cold 
SRMU. 

Intact  Vehicle  Cases 

Within  an  event  tree,  various  configurations  of  the  ve¬ 
hicle  may  be  generated  depending  on  the  consequential 
failures  that  might  occur  after  an  initial  single  point  fail¬ 
ure.  As  indicated  in  Figure  1,  one  possibility  is  the  fully 
intact  vehicle,  while  another  is  an  intact  SRMU  and  a 
separate,  intact,  SRMU/core  vehicle  combination.  The 
latter  configuration(s)  may  occur  because  of  attach  point 
failure  between  one  or  both  SRMU(s)  and  the  core.  The 
trajectory  for  each  of  these  cases  can  be  followed  using  a 
6  DOF  (Degree-of-Freedom)  simulation  (computer  code) 
with  the  appropriate  aerodynamics,  guidance  information 
and  control  authority.  The  timing  of  configuration 
changes  (i.e.,  attachment  failures)  can  be  determined  by 
incorporating  a  structural  analysis  into  the  simulation. 
Generally  speaking,  attach  point  failures  are  precluded 
only  by  ground  impact  or  by  range  safety  FTS  operation. 
The  relative  probabilities  of  these  events  usually  depend 
on  the  time  after  launch  when  the  initial  single  point  fail¬ 
ure,  occurs. 

Aerodynamics:  Examination  of  the  event  trees  indicates 
that  four  vehicle  configurations  with  an  intact  SRMU* 
can  occur:  the  original  fully  intact  vehicle  with  two 
SRMUs,  a  core  vehicle/SRMU  combination,  and  the  same 
two  configurations  with  the  Centaur  (upper  stage)  re¬ 
moved  and  called  the  modified  core/vehicle  and  the  modi¬ 
fied  core/SRMU.  Each  of  these  has  a  unique  set  of  aero- 


*  A  separated  SRMU  alone  is  not  considered  since  a  built- 
in  system  automatically  fires  the  FTS  in  that  eventuality; 
clearly  this  will  result  in  propellant  fragments  only,  as  dis¬ 
cussed  above. 


dynamic  coefficients  to  be  used  in  the  6  DOF  simulation. 
The  basic  vehicle  data  were  taken  from  the  TITAN  IV 
databook.  For  the  other  configurations,  at  low  angles  of 
attack,  empirical  and  DATCOM  (a  standard  Air  Force  aero- 
prediction  code)  methods  were  used  to  determine  the  co¬ 
efficients.  At  high  angles  of  attack  (up  to  180°;  some  of 
the  vehicles  tumble)  the  low  angle-of-attack  data  were 
extrapolated  using  empirical  methods. 

Attach  Points:  SRMUs  are  attached  to  the  core  vehicle, 
forward  at  a  shear  fitting  and  at  outriggers  and  aft  at  “A” 
points.  For  a  given  failure  scenario,  the  system  is  subject 
to  significant  acceleration,  angular  rates  and  thrust;  aero¬ 
dynamic  loads  and  angular  accelerations  were  shown  not 
to  be  of  concern.  Resulting  moments,  derived  from  stat¬ 
ics,  were  evaluated  to  determine  the  vertical,  lateral  and 
horizontal  reactions  at  each  attach  point  and  shear  fitting. 
Load  components  were  summed  and  compared  to  attach 
point  capabilities  in  their  respective  directions.  A  Margin 
of  Safety  (MOS)  calculation  was  defined  for  each  direc¬ 
tion,  for  each  attach  point,  by  dividing  the  structural  ca¬ 
pability  by  the  applied  load  and  subtracting  one.  This 
was  introduced  into  the  6  DOF  code  and  computed  at  each 
time  increment;  the  first  MOS  that  becomes  negative  de¬ 
fines  an  attach  point  failure  leading  to  SRMU  separa¬ 
tion. 

6  DOF:  The  6  DOF  simulation  is  a  computer  code  with 
subroutines  that  predict  vehicle  motion  and  orientation 
for  all  of  the  above  described  configurations.  The  simu¬ 
lation  uses  flight  control  equations  from  the  TITAN  IV 
prime  contractor  software  development  group  and  includes 
features  such  as  autopilot  executive.  Stage  0  (SRMU)  mix 
and  limit  function,  cant  angle  logic,  segment  change  logic, 
and  malfunction  reset  logic.  The  code  inputs  are  the  nomi¬ 
nal  trajectory,  mass  properties  and  aerodynamics  of  the 
intact  baseline  vehicle,  propulsion  thrust  vs  time,  guid¬ 
ance  and  control  autopilot  functions,  aerodynamic  coeffi¬ 
cients  of  altered  configurations  as  described  above,  the 
MOS  subroutine  just  described  and  meteorological  data 
vs  altitude.  The  code  output  predicts  vehicle  motion  for 
each  failure  mode  and  determines  impact  time,  location, 
velocity  and  orientation  including  total  vector  velocity  and 
vertical  velocity  (to  predict  explosive  energy  output), 
ground-track  coordinates,  altitude,  body  angles,  inclina¬ 
tion,  azimuth,  pitch  and  yaw  rates  and  MOSs  for  all  at¬ 
tachments.  These  are  the  data  necessary  to  determine  the 
location  and  magnitude  of  the  explosive  yield  if  the  ve¬ 
hicle  (two  SRMUs)  or  a  single  SRMU  impacts  the  ground. 

As  indicated  above,  the  6  DOF  code  was  specifically  used 
to  determine  the  probabilities  associated  with  multiple 
paths  when  considering  attach  point  failures.  Although 
the  simulation  is  a  deterministic  tool,  probability  paths 
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were  estimated  by  running  a  single  failure  mode  with  vari¬ 
ous  events  allowed  or  inhibited.  For  example,  the  attach 
point  failures  would  be  inhibited  to  obtain  a  particular 
logic  path  or  the  FTS  system  would  he  inhibited  and  the 
vehicle  allowed  to  fly  to  impact.  From  the  relative  times 
of  these  possible  events,  the  relative  probabilities  of  at¬ 
tach  point  failure,  FTS  and  ground  impact  were  estimated 
for  each  of  several  failure  times  for  the  initiating  single 
point  failure. 

Failed  Motor  Segment  Cases 

When  a  SRMU  case  fails  by  FTS,  bumthrough,  etc.,  the 
graphite-epoxy  wrap  is  expected  to  unravel  very  rapidly, 
leaving  full  motor  pressure  within  the  burning  core  and 
no  restraining  force  on  the  unlit  outer  periphery.  This 
may  occur  for  all  three  segments  (for  an  FTS)  or  for  only 
one  of  the  segments  (in  a  bumthrough).  As  seen  in  the 
third  column  of  the  Supporting  Analyses  portion  of  Fig¬ 
ure  1,  this  will  lead  to  a  fragment  size  (weight)  distribu¬ 
tion  and  a  velocity  increment  radial  to  the  center  line  of 
the  SRMU  which  must  be  vectorially  added  to  the  ve¬ 
hicle  state-vector  velocity  obtaining  at  the  time  of  the 
breakup.  At  the  same  time,  any  segments  not  involved  in 
the  breakup  will  be  released  intact  with  only  state- vector 
velocities  and  no  velocity  increment. 

Fragmentation  Model:  Contrary  to  our  expectations, 
very  little  data  exists  regarding  the  size  distribution  of  a 
fragmented  rocket  motor  grain.  The  major  reason  is  that 
most  propellants  will  burn  at  atmospheric  pressure  and 
very  few  pieces  are  unignited  or  inadvertently  quenched 
in  the  failure  process.  Although  many  flights  and  tests 
are  documented  with  photography  we  could  not  obtain 
realistic  data  from  such  sources.  Therefore,  it  was  con¬ 
cluded  that  a  plausible  theory  should  be  applied.  The 
fragmentation  model  utilized  for  this  study  is  based  on  an 
empirical  relation  developed  from  crushing  and  grinding 
theory.  Several  other  models  were  also  considered  (prob¬ 
ability  theory  of  point/area/volume  defects  and  flaw  line 
and  energy  density  probability,  and  two-  and  three-dimen¬ 
sional  mechanical  breakup  theory  as  in  warhead  design). 
But  these  were  considered  too  complex  to  justify  their 
use.  The  chosen  model  is  the  simplest  of  those  consid¬ 
ered  and  is  consistent  with  all  of  them.  It  is  a  theoretical 
exponential  distribution  and  states  that  the  number  of  frag¬ 
ments  greater  than  a  given  size  divided  by  the  total  num¬ 
ber  of  fragments  is  equal  to  e  (the  natural  logarithmic  base) 
to  the  negative  power  formed  by  the  fragment  size  di¬ 
vided  by  the  average  fragment  size.  Except  for  the  aver¬ 
age  fragment  size,  each  of  the  terms  in  this  expression 
can  be  related  to  total  propellant  weight  at  any  given  fail¬ 
ure  time.  Average  size  was  correlated  with  web  thickness 
using  (scant)  available  data  from  ground  FTS  tests  of 


Peacekeeper  Stage  HI,  Small  ICBM  Stage  I  and  C-4.  This 
correlation  and  the  distribution  function  then  allow  a  math¬ 
ematical  determination  of  the  statistical  weight  of  every 
fragment.  By  dividing  all  the  fragments  into  a  limited 
number  of  weight  bands,  the  average  weight  per  band  and 
the  number  of  fragments  in  that  band  can  be  determined. 
This  provides  a  complete,  statistically  reasonable  weight 
distribution  of  fragments  for  any  failure  time. 

Radial  Velocity  Increment:  As  with  fragment  size  dis¬ 
tribution,  there  is  virtually  no  database  for  the  expulsion 
velocity  of  propellant  on  failure  of  a  motor  case  even 
though  film  coverage  of  this  type  of  event  is  plentiful. 
Therefore  a  new  predictive  method,  known  as  the  “incre¬ 
mental  force  balance  method,”  was  developed  to  estimate 
this  expulsion  velocity.  It  assumes  rigid  annular-segment 
shaped  fragments,  adiabatic/insentropic  expansion  of  the 
core  gas,  sonic  (choked)  flow  between  fragments,  realis¬ 
tic  geometric  pressure  distribution  on  fragments  and  no 
axial  flow  (which  means  that  all  fragments  are  expelled 
radially  only). 

The  method  is  based  on  conservation  of  gas  mass,  the 
continuity  equation,  isentropic  flow  relationships,  the  core 
gas  equation-of  state  and  Newton’s  laws  of  motion.  It 
accounts  for  pressure  reduction  on  fragments  due  to  the 
growth  of  the  central  core  (gas  expansion)  as  well  as  leak¬ 
age  from  the  central  core  between  fragments,  and  assumes 
all  fragment  motion  is  due  only  to  pressure  forces.  From 
a  well-documented  chamber  pressure  history  for  an 
SRMU,  and  the  applicable  set  of  iterative  equations,  a 
unique  fragment  velocity  is  predicted  for  each  failure  time. 
The  method  assumes  that,  at  the  time  of  the  burst,  for  the 
bulk  of  the  propellant,  the  fragments  are  initially  similar 
in  size,  shape  and  weight  are  thus  all  expelled  at  the  same 
velocity.  Continued  fragment  breakup  is  assumed  to  oc¬ 
cur  after  this  initial  acceleration  because  of  fragment  in¬ 
teraction  and  crack  propagation  leading  to  the  above  frag¬ 
ment  size  distribution. 

Because  of  uncertainties  associated  with  fragment  shape 
and  surface  roughness,  non-uniformities  in  the  grain  frag¬ 
mentation  and  case  failure  processes,  and  geometrical 
variations  in  web  thickness,  a  ±20%  variability  in  com¬ 
puted  velocity  increment  was  assigned. 

3  DOF:  As  discussed  above,  and  indicated  in  Figure  1, 
both  fragments  and  possibly  intact  segments  can  be  re¬ 
leased  in  the  failed  motor  segment  case.  In  both  instances, 
the  subsequent  trajectory  to  the  ground  is  calculated  with 
a  3  DOF  simulation  which  computes  ballistic  trajectories 
for  unguided/uncontrolled/unpropelled  objects  and  de¬ 
pends  only  on  gravitational  and  aerodynamic  (drag)  forces 
and  the  initial  velocity  vectors. 
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Fragments:  We  assume  that  the  fragments  are  non-burn¬ 
ing  cubes,  tumbling  randomly.  The  nominal  drag  is  ob¬ 
tained  from  the  literature  and  a  ±20%  variability  in  the 
coefficient  is  assumed.  At  the  time  of  failure,  the  veloc¬ 
ity  vector  of  each  fragment  (represented  by  an  average 
fragment  for  each  weight  band)  is  determined  by  adding 
the  applicable  expulsion  velocity  increment  (see  above) 
to  the  vehicle  velocity  to  vectorially  determine  the  new 
fragment  velocity.  Clearly  we  do  not  know  which  posi¬ 
tion  around  the  circumference  of  the  failed  segment  a  given 
fragment  will  come  from.  We  therefore  assume  the  frag¬ 
ments  are  equally  likely  to  come  from  any  position  and 
arbitrarily  choose  eight  positions  at  45°  intervals  around 
the  circumference;  thus  each  interval  has  a  one-eighth 
probability  of  being  the  source  of  the  fragment.  By  know¬ 
ing  the  vehicle  body  orientation  (inclination  and  azimuth) 
from  the  6  DOF  simulation  at  the  failure  time,  we  com¬ 
pute  all  eight,  3  DOF  trajectories.  Each  gives  the  impact 
time,  location  relative  to  the  launch  site  and  ground  im¬ 
pact  velocity.  The  pattern  of  eight  points  per  initial  con¬ 
dition  (failure  time  and  fragment  weight)  gives  an  “im¬ 
pact  ellipse”  on  the  ground  with  the  probability  that  the 
fragment  will  impact  between  any  two  adjacent  points 
equal  to  one-eighth.  This  can  be  viewed  as  “mapping” 
the  fragments  from  the  SRMU  segment  to  the  ground. 
For  nominal  drag  and  expulsion  velocity,  this  is  called 
the  nominal  impact  ellipse. 

The  process  is  repeated  for  the  same  fragment  with  a  ±20% 
variation  in  expulsion  velocity  and  drag  thus  defining  five 
impact  ellipses  in  total.  A  portion  of  each  ellipse  is  fit 
with  a  second  order,  non-linear  equation  that  is  used  to 
determine  the  “center”  of  the  ellipse,  the  angle  of  its  ma¬ 
jor  and  minor  axes  relative  to  north  and  east  at  the  launch 
site,  as  well  as  the  magnitude  of  the  major  and  minor  axes. 

The  ground  is  divided  into  square  cells  the  size  of  which 
depend  on  the  perimeter  of  the  nominal  ellipse.  The  com¬ 
bination  of  tbe  five  ellipses  then  determines  a  PDF  (Prob¬ 
ability  Density  Function)  for  the  probability  of  fragment 
impact  on  the  cells. 

The  “thickness”  of  the  combined  ellipse  is  first  defined 
by  measuring  distances  from  the  nominal  ellipse  along 
the  major  and  minor  axes  and  finding  the  maximum  root- 
mean-square  of  the  averages  between  the  drag  and  expul¬ 
sion  velocity  cases.  A  rectangular  “ellipse  area”  is  then 
defined  by  seven  times  this  value  from  the  nominal  el¬ 
lipse,  in  the  major  and  minor  axis  directions.  This  ap¬ 
proach  assures  that  this  somewhat  restricted  area  will  sta¬ 
tistically  capture  ah  impacts.  In  any  given  instance,  we 
need  only  computationally  consider  those  cells  within  the 
ellipse  area. 


As  a  check  on  the  procedure,  we  compute  the  probability 
of  impact  of  any  fragment  in  the  impact  ellipse  area  and  it 
should  be  equal  to  1.0.  We  then  determine  the  maximum 
range  consistent  with  the  blast  overpressure  of  interest 
(chosen  in  the  course  of  the  computations)  for  the  largest 
(average)  fragment  from  a  standard  set  of  tables.  Adding 
this  range  around  a  rectangular  area  enclosing  all  the  vul¬ 
nerable  locations  defines  a  larger  area  called  the  “hazard” 
area. 

This  complex  procedure  is  made  computationally  efficient 
by  considering  cells  only  in  the  “intersection”  area  de¬ 
fined  by  the  overlap  of  the  hazard  area  and  the  impact 
ellipse  area.  Sequencing  cell-by-cell,  the  shortest  distance 
to  the  nominal  ellipse  and  the  four  others  is  determined 
and  the  local  “thickness”  calculated  along  the  particular 
normal  to  the  nominal  ellipse;  from  this  the  number  of 
“thicknesses”  from  the  cell  to  the  nominal  ellipse  is  de¬ 
termined.  Assuming  a  standard  normal  (Gaussian)  distri¬ 
bution  normal  to  the  ellipse,  and  a  uniform  distribution 
along  tbe  ellipse,  the  probability  of  landing  in  the  cell  is 
computed.  Repeating  this  procedure  for  all  cells  in  the 
intersection  area  produces  a  map  of  the  distribution  func¬ 
tions  for  the  impact  ellipse.  Figure  7  illustrates  the  result 
obtained.  The  peak  probabilities  are  at  mid-point  of  the 
thickness  and  decrease  “normally”  both  away  from,  and 
toward,  the  center  of  the  ellipse.  The  boundaries  of  the 
eight  sectors  chosen  above  can  be  clearly  seen.  In  the 
figure,  the  white  (A)  and  red  (B)  areas  denote  high  prob¬ 
ability  while  the  green  (C)  and  purple  (D)  areas  indicate 
low  probability.  It  is  noted  that  the  peak  probability  is 
not  constant  around  tbe  perimeter  of  the  ellipse.  The 
southeast  quadrant  of  the  ellipse  exhibits  tbe  highest  prob¬ 
ability. 


Figure  7.  Sample  Impact  Elipse  (l/8th 
Probability  Sectors  Marked) 
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Generally  speaking,  the  cell  of  interest  will  not  be  at  (or 
even  near)  the  nominal  ellipse  for  which  fragment  impact 
velocities  are  defined.  Although  fragment  weight  for  each 
of  the  eight  points  on  the  nominal  ellipse  is  the  same  (by 
definition),  the  impact  velocity  varies  somewhat  over  the 
ellipse  perimeter  because  of  differences  in  trajectories. 
The  reciprocal  of  the  impact  velocity  at  the  cell  is  as¬ 
sumed  proportional  to  the  ratio  of  the  sum  of  the  square 
of  the  inverse  distances  from  the  cell  to  the  known  eight 
impact  points  divided  by  the  sum  of  the  respective  known 
eight  impact  velocities  divided  by  the  square  of  the  same 
distances.  Thus  the  impact  velocity  for  each  sized  frag¬ 
ment  at  each  cell  can  be  computed. 

This  new  method  effectively  accounts  for  all  fragments 
from  a  segment,  or  from  an  entire  SRMU,  and  provides 
an  appropriate  statistical  description  of  events  on  the 
ground. 

Segments:  Whenever  fragments  are  produced  by  a  failed 
motor  segment,  there  may  also  be  intact  segments  gener¬ 
ated.  They  are  assumed  to  be  cylindrical,  tumbling  ran¬ 
domly  and  non-burning.  Because  they  are  intact,  no  in¬ 
cremental  velocity  is  applied  to  segments;  their  initial  ve¬ 
locity  vector,  with  small  uncertainty,  is  the  state  vector  of 
the  vehicle  at  the  time  of  the  failure.  The  nominal  drag, 
with  small  uncertainty,  is  determined  from  an  empirical 
relationship  for  tumbling,  low  fineness  ratio  cylinders 
coupled  with  data  at  0°  and  90°  angle-of-attack.  The  lo¬ 
cation  and  ground  impact  velocity  of  the  segment(s)  are 
determined  fi'om  the  3  DOF  simulation. 

All  trajectories  evaluated  for  the  supporting  analyses  seen 
in  Figure  1  lead  to  ground  impact  of  propellant  as  frag¬ 
ments,  segments,  SRMUs  or  as  an  intact  vehicle.  In 
each  case,  it  is  necessary  to  determine  the  behavior  of  the 
propellant  in  terms  of  the  production  of  blast  waves  that 
can  propagate  to  the  surrounding  vulnerable  locations. 

Explosive  Yield  Correlation 

Because  SRMU  propellant  consists  primarily  of  ammo¬ 
nium  perchlorate  (AP),  powdered  aluminum  (Al)  and  a 
rubbery  binder  (HTPB  =  Hydroxy-Terminated-Poly-Buta- 
diene)  it  is  considered  a  Class  1.3  propellant.  It  has  been 
traditionally  assumed  not  to  be  detonable  as  are  other  pro¬ 
pellants,  such  as  Class  1.1,  which  usually  contain  various 
militaiy  high  explosives.  Recently,  it  has  been  accepted 
that  this  traditional  view  is  only  partly  accurate  and  that 
these  materials  are  capable  of  explosive  reactions  up  to 
and  including  full  detonation  given  the  right  circum¬ 
stances.  If  even  a  “partial”  or  “fading”  detonation  oc¬ 
curs,  blast  waves  from  large  propellant  samples  are  po¬ 
tentially  damaging.  What  was  needed  for  this  study  was 


a  quantitative  correlation  of  the  extent  of  the  explosive 
yield  given  an  impact  of  a  given  weight  of  propellant  at  a 
given  velocity  on  a  given  surface. 

Impact  Data 

Unfortunately,  there  is  only  a  relatively  small  body  of  such 
impact  data;  at  least  for  Class  1.3  propellant.  While  two 
sources  reported  scientific  findings  (SANDIA  and 
Lawrence  Livermore  National  Laboratory),  the  majority 
and  most  relevant  data  in  terms  of  the  weight  of  the 
samples  are  contained  in  a  document  describing  “fallback” 
events  of  failed,  live  missile  firings  for  which  yields  were 
roughly  estimated.  Nevertheless,  the  data  were  trans¬ 
formed  to  a  common  steel  impact  basis  using  standard 
impedance-mismatch  calculations  using  the  shock-equa- 
tion-of-state  (called  the  Hugoniot)  of  the  materials  in¬ 
volved.  The  procedure  was  to  determine  the  shock  pres¬ 
sure  in  the  propellant  in  the  actual  event  and  then  calcu¬ 
late  the  equivalent  steel  impact  velocity  that  would  gen¬ 
erate  the  same  shock  pressure  in  the  propellant.  These 
data  directly  represent  the  type  of  information  needed, 
but  the  lack  of  data  (22  points  total)  is  of  concern  if  a 
good  statistical  correlation  is  desired. 

Donor  Data  -  Impulse  Correlation 

There  are  a  number  of  Class  1 .3  rocket  motors  (or  propel¬ 
lants)  which  were  tested  by  “boostering”  with  high  ex¬ 
plosive  donors,  either  Class  1 . 1  rocket  motors  or  military 
high  explosives.  Boostering  in  these  tests  means  that  a 
donor  was  placed  on  or  near  the  propellant  and  the  results 
reported  as  yield  of  the  Class  1.3  propellant  (the  accep¬ 
tor)  for  the  given  geometry,  shape,  weights  and  separa¬ 
tion  from  the  donor.  These  donor  data  were  converted  to 
an  equivalent  steel  impact  velocity  by  equating  the  im¬ 
pulse  delivered  to  the  acceptor  in  an  impact  event  with 
that  delivered  by  the  explosive  donor.  This  resulted  in  a 
linear  expression  relating  effective  steel  impact  velocity 
to  the  ratio  of  the  donor  weight  to  the  acceptor  weight 
and  several  fixed  parameters  which  correct  for  donor  com¬ 
position  and  geometry,  donor/acceptor  separation  and 
motion  of  acceptor.  Using  this  expression,  ah  of  the  do¬ 
nor  data  (31  points)  were  converted  to  equivalent  impact 
data. 

Correlation 

The  impact  and  donor  data  (53  points)  were  combined 
and  correlated  to  obtain  the  desired  relationship  of  steel 
impact  velocity  (V)  vs  propellant  weight  (W)  vs  yield  (z), 
defined  as  the  fraction  of  the  propellant  weight  that  un¬ 
dergoes  detonation.  Because  of  the  logarithmic  nature  of 
the  physico-chemical  processes  Involved,  and  to  allow  sta- 
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tistical  treatment  of  the  data,  100%  yield  points  (i.e.,  full 
detonation)  were  assigned  a  value  of  99%  and  0%  yield 
points  were  assigned  a  value  of  0.1%.  Further,  each  data 
point  was  assigned  a  weighting  factor  as  a  measure  of  the 
relative  reliability  of  the  data  based  on  the  original  test 
reports. 

The  correlation  technique  adopted  (after  considering  sev¬ 
eral  alternatives)  was  to  assume  that  the  quantity  u,  one 
minus  yield  over  yield  [(1  -  z)/z],  is  distributed  lognor- 
mally;  i.e.,  follows  the  Gaussian  distribution  of  the  natu¬ 
ral  logarithm  (In)  of  u.  This  makes  sense  since  z  by  defi¬ 
nition  varies  from  1  to  0,  u  varies  from  0  to  -oo  and  there¬ 
fore  Inu  varies  from  -<»  to  +oo,  which  is  appropriate  for  a 
normal  distribution.  Of  many  possible  alternatives,  it  was 
found  that  the  expression,  InV  =  A  +  BlnW  +  Clnu  + 
DlnWlnu,  was  the  “best”  correlation  function,  having  a 
correlation  coefficient  of  =85%.  Using  linear  regression, 
the  constants  A,  B,  C  and  D  were  determined  from  the 
compiled  data. 

The  result  is  shown  in  Figure  8,  which  correlates  impact 
velocity  vs  propellant  weight  vs  yield  for  steel  impact. 
Because  of  the  nature  of  the  development  of  the  correla¬ 


tion,  any  point  on  the  plot  represents  the  median  of  a  dis¬ 
tribution  function  of  yield,  normal  to  the  z  direction;  this 
distribution  is  not  shown  on  the  plot,  only  the  midpoints. 
This  simply  means  that  the  same  weight  of  propellant  im¬ 
pacting  at  the  same  velocity  would  produce  a  series  of 
statistically  varying  yields  (not  the  same  one  every  time) 
of  which  the  given  point  is  the  median.  The  quantity  u  is 
distributed  lognormally.  The  “spread”  of  this  distribu¬ 
tion,  called  the  variance  factor  of  the  yield  distribution 
(k)  was  also  estimated  from  the  raw  data. 

For  purposes  of  standardization,  the  correlation  in  Figure 
8  is  based  on  shock  pressure  generated  by  steel  impact. 
This  does  not  match  the  varied  and  quite  different  surface 
materials  actually  surrounding  the  launch  site.  Three  sur¬ 
face  materials  were  shown  to  closely  represent  all  these 
surfaces:  concrete  in  the  vicinity  of  the  pad,  sand  in  the 
surrounding  on-shore  land  and  water  in  the  surrounding 
off-coast  areas.  Using  impedance  mismatch  calculations 
based  on  the  respective  average  Hugoniots  of  these  mate¬ 
rials,  the  impact  velocity  on  that  surface,  that  will  pro¬ 
duce  the  same  shock  pressure  in  the  propellant  as  would 
a  given  impact  velocity  on  steel,  was  calculated.  The  ra¬ 
tio  of  the  impact  velocity  required  for  the  surface  of  inter- 
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est  to  that  determined  for  steel  impact,  in  this  way,  is  de¬ 
fined  as  the  surface  factor  (S).  For  each  of  the  three  sur¬ 
faces  it  was  found  that  S  only  varied  slightly  over  the 
entire  W  and  z  range  of  interest.  The  average  factors,  S  = 
1.41  for  concrete,  S  =  1.81  for  sand  and  S  =  2.92  for  wa¬ 
ter,  can  therefore  be  used  to  effectively  transform  Figure 
8  to  the  applicable  impact  surface. 

Figure  8  is  usable  for  all  ground  impacts  of  propellant 
weight  W  at  velocity  V.  Assuming  a  given  impact  loca¬ 
tion,  the  surface  material  and  surface  factor  S  are  identi¬ 
fied.  From  this  modified  velocity  V/S,  Figure  8  gives  the 
median  yield  z  (usually  denoted  Z5q).  Therefore  the  me¬ 
dian  propellant  weight  exploded  is  Z50W,  and  the  median 
“TNT  equivalent”  is  1  .2z5qW.  Here,  the  amount  exploded 
is  converted  to  a  standard,  the  amount  of  TNT  which  when 
detonated  would  produce  the  same  blast;  1 .2  is  the  gener¬ 
ally  accepted  factor  for  Class  1.3  propellants.  The  blast 
overpressure  produced  by  this  weight  of  TNT  is  computed 
for  a  given  range  from  the  impact  point  with  a  well-known 
set  of  equations  called  the  Kingery-Bulmash  relationships. 
Of  course,  in  any  given  case,  this  is  the  “median”  value 
and  it  can  vary  in  accord  with  the  previously  described 
distribution  function. 

Probability  Assessment 

With  reference  to  Figure  1,  all  the  elements  of  the  meth¬ 
odology  up  to  the  last  are  in  place.  It  is  now  necessary  to 
analyze  all  the  branches  of  the  event  trees,  for  each  vul¬ 
nerable  location,  to  “add  up,”  probabilistically,  all  the  pos¬ 
sible  events  and  all  the  possible  consequences  to  deter¬ 
mine  the  probability  of  exceeding  a  given  level  of  blast 
overpressure  vs  blast  overpressure.  This  will  determine 
the  overall  risk  of  the  given  launch,  to  that  particular  lo¬ 
cation. 

ProbabUity  Calculations 

For  all  failure  modes  which  lead  to  a  respective  event  tree 
at  a  given  failure  time  T,  the  “chain”  equation  can  be  writ¬ 
ten  as  a  sum  of  product  terms.  The  first  is  the  probability 
of  the  failure  mode;  the  second  is  the  probability  of  ex¬ 
ceeding  a  given  (chosen)  blast  level  at  T  given  the  failure 
mode.  Since  the  failure  is  assumed  to  be  equally  likely 
for  all  times,  the  chain  equation  is  integrated  from  T  =  0 
sec  to  Tmax  sec,  defined  as  the  time  after  which  signifi¬ 
cant  blast  cannot  reach  any  vulnerable  location  (found  to 
be  approximately  25  seconds  after  launch). 

For  each  vulnerable  location,  repeat  calculations  for  a  se¬ 
ries  of  values  of  blast  overpressure,  produce  the  general 
result:  the  function,  probability  of  exceeding  blast  over¬ 
pressure  vs  blast  overpressure. 


By  definition,  the  probability  of  a  failure  mode  is  uniquely 
related  to  the  complement  (one  minus)  of  the  reliability 
of  the  component/subsystem/system  that  is  assumed  to 
have  failed.  These  data  are  usually  available  as  part  of 
the  system  specifications  and  published  in  the  FMEA 
document,  or  in  an  EIS  (Environmental  Impact  Statement) 
or  as  an  engineering  estimate.  Since  these  data  generally 
refer  to  any  failure  at  any  time  during  the  launch,  the 
“book”  values  cited  need  to  be  modified  for  our  purposes 
to  represent  both  the  fraction  of  all  failures  of  the  compo¬ 
nent/subsystem/system  that  lead  to  the  specific  failure 
mode  we  are  considering,  and  those  failures  that  could 
occur  within  the  selected  time  increment  (or  at  the  speci¬ 
fied  event)  that  we  care  about;  e.g.,  failures  after  Tjjj^x 
are  of  no  concern.  These  modifications  represent  the  cor¬ 
rection  factors  previously  cited. 

The  more  difficult  issue  is  to  determine,  for  each  failure 
mode,  the  probability  of  exceeding  the  chosen  blast  level. 

This  is  accomplished  by  analysis  of  the  event  trees,  which 
arrange  failure  modes  systematically  starting  with  single 
point  failures  and  developing  all  possible  consequential 
failures  including  probabilistic  branches.  All  events  even¬ 
tually  lead  to  one  of  the  five  final  propellant  states.  As 
previously  discussed,  branch  probabilities  were  deter¬ 
mined  based  on  engineering  judgement  or  analyses  con¬ 
sidering  the  physical  nature  of  the  event.  For  mechanical 
failure  of  attachments,  the  various  probabilities  of  vari¬ 
ous  paths  (ground  impact  before  structural  failure  or  FTS 
before  ground  impact,  etc.)  were  found  to  change  signifi¬ 
cantly  with  the  timing  of  the  initial  failure. 

General  Procedure  for  Fragments:  For  each  failure  time 
there  are  six  impact  ellipse  areas  (each  consisting  of  five 
ellipses)  which  correspond  to  the  six  weight  bands  cho¬ 
sen.  Each  fragment  will  impact  in  an  impact  ellipse  area 
and  contribute  blast  overpressure  to  the  vulnerable  loca¬ 
tion.  The  ground  surrounding  this  location  is  divided  into 
a  suitable  matrix  of  cell  areas  each  at  a  known  range.  For 
a  chosen  blast  overpressure,  we  index  through  each  cell 
in  turn,  and  determine  the  probability  of  a  fragment  land¬ 
ing  in  the  cell  (see  Figure  7),  and  the  probability  of  ex¬ 
ceeding  the  chosen  overpressure  from  its  impact  velocity 
and  location  (see  Figure  8  and  the  Kingery  &  Bulmash 
relationships).  The  product  of  these  is  the  probability  of 
exceeding  the  overpressure  for  the  one  average  weight 
fragment  for  the  one  cell.  For  multiple  fragments  in  the 
band,  this  result  is  modified  to  include  the  sum  of  product 
terms  of  the  probability  of  one  (through  all)  fragments 
landing  in  the  cell  and  the  probability  that  these  multiple 
impacts  will  cause  the  overpressure  chosen.  This  result 
is  then  obtained  for  each  cell  and,  assuming  independent 
events,  evaluated  for  ah  cells  from  “one  minus  the  prod- 
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uct  of  one  minus  the  probability  for  each  cell.”  Next, 
having  up  to  six  weight  bands,  the  last  result  is  deter¬ 
mined  for  each  band  and  evaluated  for  all  bands  using  the 
same  product  rule  just  stated,  but  replacing  “cell”  with 
“weight  band.”  This  gives  the  final  result  for  fragments 
of  the  “net”  probability  of  exceeding  the  chosen  overpres¬ 
sure  at  the  vulnerable  location  for  the  chosen  failure  mode 
and  failure  time. 

General  Procedure  for  Segments,  SRMUs:  Large  pro¬ 
pellant  masses  are  treated  individually.  For  single  or  paired 
segments,  the  impact  velocity  and  location  are  known  di¬ 
rectly  from  the  3  DOF  code  since  they  are  ballistic;  for 
SRMUs  attached  to  the  core  or  the  entire  vehicle,  these 
values  are  known  from  the  6  DOF  simulation  since  they 
are  still  being  “guided.”  Variability  in  impact  location  is 
modeled  as  a  bivariate  normal  distribution.  Knowing  the 
weight  and  velocity  at  impact,  the  yield  is  determined 
from  the  yield  correlation  (Figure  8).  A  “lethal  range” 
(beyond  which  the  chosen  overpressure  will  not  be  ex¬ 
ceeded)  is  then  defined  from  the  Kingery-Bulmash  rela¬ 
tionships  noting  that  this  quantity  is  a  random  variable 
because  yield  is  a  random  variable  (see  discussion  of  Ex¬ 
plosive  Yield  Correlation).  The  probability  of  exceeding 
a  chosen  level  of  overpressure  at  a  given  vulnerable  loca¬ 
tion  is  then  calculated  by  the  coverage  function  (for  sta¬ 
tistically  minded  readers,  a  non-central  chi  squared  dis¬ 
tribution  with  2  DOF)  which  integrates  the  bivariate  nor¬ 
mal  distribution  over  an  offset  circle  with  radius  equal  to 
the  lethal  range,  centered  at  the  vulnerable  location.  The 
expected  value  of  the  probability  of  exceeding  the  over¬ 
pressure  is  found  by  integrating  the  coverage  function  over 
all  values  of  lethal  range  up  to  the  maximum  value  de¬ 
fined  at  a  yield  of  100%. 

Given  an  event  tree  describing  one  failure  mode  at  one 
time,  a  generalized  sequence  of  calculations  is  used  to 
work  through  afi  final  states  and  all  branches  for  all  times 
for  each  chosen  overpressure,  for  each  vulnerable  loca¬ 
tion. 

The  probability  of  exceeding  the  overpressure  for  any  fi¬ 
nal  state  is  the  product  of  the  branch  probabilities  leading 
to  that  state  and  the  probability  of  exceeding  the  over¬ 
pressure  given  that  branch  (these  are  the  numbers  calcu¬ 
lated  using  the  general  procedures  above).  Calculations 
are  repeated  for  every  final  state  at  every  time  and  the 
results  integrated  over  the  time  of  interest  to  give  the  av¬ 
erage  or  expected  probability  of  exceeding  the  overpres¬ 
sure.  This  is  repeated  for  a  sequence  of  overpressures, 
usually  0. 1 , 0.25,  0.5, 1 ,  2, 4,  and  8  psi,  and  then  for  each 
location. 


Since  all  failure  modes  can  affect  each  vulnerable  loca¬ 
tion,  the  individual  results  are  combined  by  summing  all 
the  products  of  the  probability  of  the  failure  mode  (as 
discussed  earlier)  and  the  probability  of  exceeding  the 
overpressures  (the  function  just  described).  This  yields 
the  final  result  of  the  probability  of  exceeding  the  over¬ 
pressure  vs  overpressure  for  all  failure  modes  at  the  loca¬ 
tion.  It  is  this  function  that  is  to  be  used  by  the  Range  to 
decide  how  safe  or  how  risky  the  launch  is  for  that  vul¬ 
nerable  location;  i.e.,  is  this  (now  quantified)  risk  accept¬ 
able? 

Example  results  are  shown  in  Figures  9  and  10  for  the 
launch  site  and  one  other  location. 

CONCLUSIONS 

The  results  in  Figure  9  show  how  the  individual  failure 
modes  stack  up  to  yield  the  upper  line,  which  is  the  over¬ 
all  result  for  vulnerable  loeation  1,  the  launch  site.  Note 
that  the  vertical  scale  is  “logarithmic”  so  that  each  major 
division  is  a  factor  of  10  less  (or  more)  than  the  next.  The 
upper  failure  modes  therefore  contribute  most  heavily  to 
the  overall  result.  For  this  case  the  probabilities  do  not 
diminish  significantly  over  the  range  of  overpressures  con¬ 
sidered.  The  analysis  shows  that  a  large  explosive  yield 
is  possible  at  the  launch  site,  which  is  at  risk  for  consider¬ 
able  damage.  The  chance  of  these  overpressures  is  about 
one  in  a  thousand,  most  of  this  due  to  the  Tip-Over  case 
(FMl  in  Figure  9)  discussed  above.  However,  assuming 
no  personnel  are  present  at  the  launch  site,  this  may  still 
be  acceptable  for  the  somewhat  risky  business  of  launch¬ 
ing  large  solid  rocket  motors. 

A  different  result  is  seen  in  Figure  10,  which  shows  a 
rapid  drop  in  probability  with  overpressure  for  the  indi¬ 
vidual  modes  and  the  total  in  the  upper  line;  the  probabil¬ 
ity  of  exceeding  relatively  modest  blast)  is  less  than  three 
chances  in  a  hundred  thousand.  This  is  an  example  of 
much  safer  vulnerable  location. 

The  summary  results  for  ten  vulnerable  locations  are 
shown  in  Figure  11.  Other  than  the  launch  site,  all  the 
locations  appear  safe  and  one  might  conclude  that,  over¬ 
all,  the  launch  risk  is  acceptable. 

One  important  feature  of  this  methodology  is  that  the  re¬ 
sults  can  be  used  not  only  to  assess  risk,  but  also  to  miti¬ 
gate  it  by  suggesting  ways  to  reduce  the  probability  of 
the  occurrence  (perhaps  a  minor  design  change  to  the  ve¬ 
hicle)  or  to  reduce  the  severity  of  an  occurrence  (perhaps 
by  changing  the  surface  properties  of  the  ground  in  the 
launch  pad  area  if  tip-over  is  the  dominant  issue). 
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Figure  11.  Probability  of  Exceeding  Ap  -  AH  Vulnerable  Locations 


In  summary,  the  methods  developed  in  this  study  have 
been  used  to  analyze  and  evaluate  the  hazards  associated 
with  the  launching  of  a  very  complex  system.  They  can 
be  used  effectively  with  any  similar  vehicle,  including 
much  smaller  and  simpler  ones,  and  can  be  an  important 
tool  for  evaluating  safety  at  any  launch  range.  Since  al¬ 
most  all  the  effort  required  is  analytical  in  nature  and  the 
method  uses  data  usually  available  in  the  design  phase  of 
the  system,  it  is  possible  to  make  risk  determinations  in  a 
timely  fashion;  the  payoff  to  Range  Safety  in  the  use  of 
these  methods  is  significant.  It  is  hoped  that  these  and 
similar  methods  are  adopted  by  the  aerospace  commu¬ 
nity  in  evaluating  the  safety  of  launch  systems. 
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